refactor(docker): use compose profiles instead of a prod override file

Collapse docker-compose.yml + docker-compose.prod.yml into one file with dev/prod
profiles sharing a YAML anchor: dev builds from source, prod pulls ghcr latest.
make up/prod select the profile; down passes both so it stops either. Drops the
separate prod file and the !reset hack.

Makefile

@@ -51,14 +51,14 @@ ci-desktop: ## CI: cargo-check for @openconcho/desktop
 smoke-docker: ## Local: build the image + smoke-test the /api proxy (Docker required)
 	bash docker/smoke-test.sh
 
-up: ## Run the web container from source (dev-forward, builds) at :8080
-	docker compose up -d --build
+up: ## Run the web container from source (dev profile, builds) at :8080
+	docker compose --profile dev up -d --build
 
-prod: ## Run the web container from the published image (pulls ghcr latest)
-	docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+prod: ## Run the web container from the published image (prod profile, pulls latest)
+	docker compose --profile prod up -d
 
-down: ## Stop + remove the web container (works for dev or prod)
-	docker compose down --remove-orphans
+down: ## Stop + remove the web container (either profile)
+	docker compose --profile dev --profile prod down --remove-orphans
 
 clean: down ## down + remove the locally built image
 	-docker image rm openconcho-web:local

README.md

@@ -107,9 +107,9 @@ make clean   # down + drop the locally built image
 # → http://localhost:8080
 ```
 
-`make up` uses [`docker-compose.yml`](docker-compose.yml) (`build: .`);
-`make prod` layers [`docker-compose.prod.yml`](docker-compose.prod.yml)
-to pull `ghcr…:latest`. `OPENCONCHO_DEFAULT_HONCHO_URL` seeds the first instance
+Both modes live in one [`docker-compose.yml`](docker-compose.yml) as Compose
+profiles: `make up` runs the `dev` profile (`build: .`), `make prod` runs the
+`prod` profile (pulls `ghcr…:latest`). `OPENCONCHO_DEFAULT_HONCHO_URL` seeds the first instance
 (absolute URL); `OPENCONCHO_UPSTREAM_ALLOWLIST` is an optional SSRF guard
 (comma-separated host globs) for when you expose the proxy. Full details and env
 vars are in [`docs/docker.md`](docs/docker.md).

docker-compose.prod.yml

@@ -1,11 +0,0 @@
-# Production override — pull the published image instead of building from source.
-# Layer it on top of docker-compose.yml; it reuses every setting there (env, ports,
-# extra_hosts) and only swaps the local build for the latest published image.
-#
-#   make prod
-#   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
-services:
-  openconcho:
-    build: !reset null
-    image: ghcr.io/offendingcommit/openconcho-web:latest
-    pull_policy: always

docker-compose.yml

@@ -1,8 +1,8 @@
-# OpenConcho web UI — DEV-FORWARD compose (builds from THIS repo).
+# OpenConcho web UI — one file, two Compose profiles (dev builds, prod pulls).
 #
-#   make up      # build from source + run               → http://localhost:8080
-#   make prod    # pull the published image instead (see docker-compose.prod.yml)
-#   make down    # stop + remove (dev or prod)
+#   make up      # profile dev:  build from THIS repo + run     → http://localhost:8080
+#   make prod    # profile prod: pull ghcr…:latest instead of building
+#   make down    # stop + remove (either profile)
 #   make clean   # down + drop the locally built image
 #
 # The SPA issues all Honcho calls same-origin to /api; nginx forwards each to the
@@ -11,13 +11,11 @@
 #
 #   OPENCONCHO_DEFAULT_HONCHO_URL=https://honcho.example.net make up
 #
-# To fold into an existing Honcho Compose stack, set OPENCONCHO_DEFAULT_HONCHO_URL
-# to the api service (e.g. http://api:8000 — nginx resolves it on the compose
-# network) and add `depends_on: { api: { condition: service_healthy } }`.
-services:
-  openconcho:
-    build: .
-    image: openconcho-web:local
+# To fold into an existing Honcho Compose stack, point the seed at the api service
+# (e.g. http://api:8000 — nginx resolves it on the compose network).
+
+# Shared config (defined once); both profiles reference it via a YAML merge.
+x-openconcho: &openconcho
   environment:
     # Absolute URL seeding the first instance; the browser sends it as the
     # X-Honcho-Upstream header and nginx forwards there (no browser CORS).
@@ -33,3 +31,18 @@ services:
   extra_hosts:
     - "host.docker.internal:host-gateway"
   restart: unless-stopped
+
+services:
+  # Dev-forward — builds from source so you run your local changes (`make up`).
+  openconcho:
+    <<: *openconcho
+    profiles: ["dev"]
+    build: .
+    image: openconcho-web:local
+
+  # Production — pulls the published image instead of building (`make prod`).
+  openconcho-prod:
+    <<: *openconcho
+    profiles: ["prod"]
+    image: ghcr.io/offendingcommit/openconcho-web:latest
+    pull_policy: always

docs/docker.md

@@ -15,24 +15,26 @@ applies**; the nginx→Honcho hop is server-side, where CORS is irrelevant. The
 frontend stays the source of truth for which instance to talk to, so the
 multi-instance switcher and the Fleet view keep working.
 
-## Compose: dev-forward vs prod
+## Compose: dev vs prod profiles
 
-Two Compose files, env/ports defined once in the base:
+One [`docker-compose.yml`](../docker-compose.yml) with two profiles; the shared
+config (env, ports, extra_hosts) is defined once via a YAML anchor:
 
-- **`docker-compose.yml`** — dev-forward: `build: .`, so it runs **your local source**.
-- **`docker-compose.prod.yml`** — override that swaps the build for the **published
-  image** (`ghcr.io/offendingcommit/openconcho-web:latest`, `pull_policy: always`).
+- **`dev` profile** — `build: .`, runs **your local source** (`make up`).
+- **`prod` profile** — pulls the **published image**
+  (`ghcr.io/offendingcommit/openconcho-web:latest`, `pull_policy: always`) (`make prod`).
 
 ```bash
 make up      # build from source + run                → http://localhost:8080
 make prod    # pull ghcr…:latest instead of building
-make down    # stop + remove (dev or prod)
+make down    # stop + remove (either profile)
 make clean   # down + drop the locally built image
 ```
 
-`make prod` expands to
-`docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d`. Set env
-inline or via a `.env` file:
+`make up` expands to `docker compose --profile dev up -d --build` and `make prod`
+to `docker compose --profile prod up -d`. A bare `docker compose up` (no profile)
+starts nothing — use the make targets or pass `--profile`. Set env inline or via a
+`.env` file:
 
 ```bash
 OPENCONCHO_DEFAULT_HONCHO_URL=https://honcho.example.net make prod